必要 AWS Config Security Hub 控制項發現的資源 - AWS 安全中樞
所有 Security Hub 控制項的必要資源FSBP標準所需的資源所需的資源 CIS AWS 基礎基準第五版所NIST需的資源3.2.1 PCI DSS 版所需的資源所需的資源 AWS 資源標記標準服務管理標準所需的資源： AWS Control Tower

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

必要 AWS Config Security Hub 控制項發現的資源

AWS Security Hub 透過對控制項執行安全檢查，產生控制項發現項 某些控制項使用 AWS Config 評估特定資源合規性的規則。若要讓 Security Hub 為具有變更觸發的排程類型的控制項產生發現項目，您必須開啟所需資源的記錄 AWS Config。 對於具有定期排程型態的大多數控制項，您不需要記錄資源。但是，某些週期性控制需要資源記錄才能偵測合規性的變更。

此頁面提供跨標準所需資源的清單，以及依標準劃分的必要資源清單。第一個表格也會列出哪些 Security Hub 控制項會使用每個資源。

如果發現項目是由安全性檢查所產生，而該檢查是以 AWS Config 規則，發現項目詳細資訊包含相關聯的「規則」連結 AWS Config 規則。若要導覽至 AWS Config 規則，您的帳戶必須具備 AWS Identity and Access Management （IAM）權限查看 AWS Config 規則。

注意

In (入) AWS 區域 如果控件不可用，則對應的資源不可用 AWS Config。 如需 Security Hub 控制項的區域限制清單，請參閱各區域控制項的可用性。

所有 Security Hub 控制項的必要資源

讓 Security Hub 為已啟用的 Security Hub 變更觸發的控制項產生發現項目 AWS Config 規則，您必須將這些資源記錄在 AWS Config。 此表格也指出哪些控制項需要特定資源。控制項可能需要多個資源。

服務 所需資源 相關控制
Amazon API 网关 AWS::ApiGateway::Stage

APIGateway.1

APIGateway.2

APIGateway.3

APIGateway.4

APIGateway.5
AWS::ApiGatewayV2::Stage

APIGateway.1

APIGateway.9
AWS AppSync AWS::AppSync::GraphQLApi

AppSync.2

AppSync.4

AppSync.5
AWS Backup (AWS Backup) AWS::Backup::BackupPlan

Backup .5
AWS::Backup::BackupVault

Backup
AWS::Backup::RecoveryPoint

Backup

Backup。2
AWS::Backup::ReportPlan

Backup .4
AWS Certificate Manager (ACM) AWS::ACM::Certificate

ACM.1

ACM.2

ACM.3
Amazon Athena AWS::Athena::DataCatalog 雅典娜 .2
AWS::Athena::WorkGroup

雅典娜 .3

雅典娜 .4
AWS CloudFormation AWS::CloudFormation::Stack

CloudFormation.2
Amazon CloudFront AWS::CloudFront::Distribution

CloudFront.1

CloudFront.3

CloudFront.4

CloudFront.5

CloudFront.6

CloudFront.7

CloudFront.8

CloudFront.9

CloudFront.10

CloudFront.13

CloudFront.14
AWS CloudTrail AWS::CloudTrail::Trail CloudTrail.9
Amazon CloudWatch AWS::CloudWatch::Alarm

CloudWatch.15

CloudWatch.17
AWS CodeArtifact AWS::CodeArtifact::Repository CodeArtifact.1
AWS CodeBuild AWS::CodeBuild::Project

CodeBuild.1

CodeBuild.2

CodeBuild.3

CodeBuild.4
AWS::CodeBuild::ReportGroup

CodeBuild.7
AWS DataSync AWS::DataSync::Task DataSync.1
Amazon Detective AWS::Detective::Graph Detective 式 1
AWS Database Migration Service (AWS DMS) AWS::DMS::Certificate

DMS.2
AWS::DMS::Endpoint

DMS.9

DMS.10

DMS.11

DMS.12
AWS::DMS::EventSubscription DMS.3
AWS::DMS::ReplicationInstance

DMS.4

DMS.6
AWS::DMS::ReplicationSubnetGroup DMS.5
AWS::DMS::ReplicationTask

DMS.7

DMS.8
Amazon DynamoDB AWS::DynamoDB::Table

DynamoDB.1

DynamoDB.2

DynamoB.5

DynamoB.6
Amazon 彈性運算雲（EC2） AWS::EC2::ClientVpnEndpoint

EC2.51
AWS::EC2::CustomerGateway EC2.36
AWS::EC2::EIP

EC2.12

EC2.37
AWS::EC2::FlowLog EC2.48
AWS::EC2::Instance

EC2.4

EC2.8

EC2.9

EC2.17

EC2.24

EC2.38

EMR.1

SSM.1
AWS::EC2::InternetGateway

EC2.39
AWS::EC2::LaunchTemplate

EC2.25
AWS::EC2::NatGateway

EC2.40
AWS::EC2::NetworkAcl

EC2.16

EC2.21

EC2.41
AWS::EC2::NetworkInterface

EC2.22

EC2.35
AWS::EC2::RouteTable EC2.42
AWS::EC2::SecurityGroup

EC2.2

EC2.13

EC2.14

EC2.18

EC2.19

EC2.43
AWS::EC2::Subnet

EC2.15

EC2.44

ElastiCache.7
AWS::EC2::TransitGateway

EC2.23

EC2.52
AWS::EC2::TransitGatewayAttachment EC2.33
AWS::EC2::TransitGatewayRouteTable EC2.34
AWS::EC2::Volume

EC2.3

EC2.45
AWS::EC2::VPC

EC2.6

EC2.46
AWS::EC2::VPCEndpointService EC2.47
AWS::EC2::VPCPeeringConnection EC2.49
AWS::EC2::VPNConnection EC2.20
AWS::EC2::VPNGateway EC2.50
Amazon EC2 Auto Scaling AWS::AutoScaling::AutoScalingGroup

AutoScaling.1

AutoScaling.2

AutoScaling.6

AutoScaling.9

AutoScaling.10
AWS::AutoScaling::LaunchConfiguration

AutoScaling.3

Autoscaling.5
Amazon EC2 Systems Manager（SSM） AWS::SSM::AssociationCompliance

SSM.3
AWS::SSM::ManagedInstanceInventory

SSM.1
AWS::SSM::PatchCompliance

SSM.2
Amazon 彈性容器註冊表（AmazonECR） AWS::ECR::PublicRepository ECR.4
AWS::ECR::Repository

ECR.2

ECR.3
Amazon 彈性容器服務（AmazonECS） AWS::ECS::Cluster

ECS.12

ECS.14
AWS::ECS::Service

ECS.2

ECS.10

ECS.13
AWS::ECS::TaskDefinition

ECS.1

ECS.3

ECS.4

ECS.5

ECS.8

ECS.9

ECS.15
Amazon Elastic File System（AmazonEFS） AWS::EFS::AccessPoint

EFS.3

EFS.4

EFS.5
AWS::EFS::FileSystem

EFS.7
Amazon Elastic Kubernetes Service（Amazon）EKS AWS::EKS::Cluster

EKS.2

EKS.6

EKS.8
AWS::EKS::IdentityProviderConfig EKS.7
AWS Elastic Beanstalk AWS::ElasticBeanstalk::Environment

ElasticBeanstalk.1

ElasticBeanstalk.2

ElasticBeanstalk.3
Elastic Load Balancing AWS::ElasticLoadBalancing::LoadBalancer

ELB.2

ELB.3

ELB.5

ELB.7

ELB.8

ELB.9

ELB.10

ELB.14
AWS::ElasticLoadBalancingV2::LoadBalancer

ELB.1

ELB.4

ELB.5

ELB.6

ELB.12

ELB.13

ELB.16
ElasticSearch AWS::Elasticsearch::Domain

ES.3

ES.4

ES.5

ES.6

ES.7

ES.8

.9
Amazon EventBridge AWS::Events::EventBus

EventBridge.2

EventBridge.3
AWS::Events::Endpoint

EventBridge.4
AWS Global Accelerator AWS::GlobalAccelerator::Accelerator

GlobalAccelerator.1
AWS Glue AWS::Glue::Job

膠水 .1

膠水 .2
AWS::Glue::MLTransform

膠水。3
Amazon GuardDuty AWS::GuardDuty::Detector

GuardDuty.4
AWS::GuardDuty::Filter

GuardDuty.2
AWS::GuardDuty::IPSet

GuardDuty.3
AWS Identity and Access Management (IAM) AWS::IAM::Group

IAM.27

KMS.2
AWS::IAM::Policy

IAM.1

IAM.21

KMS.1
AWS::IAM::Role

IAM.24

IAM.27

KMS.2
AWS::IAM::User

IAM.2

IAM.3

IAM.5

IAM.8

IAM.19

IAM.22

IAM.25

IAM.27

KMS.2
AWS Identity and Access Management Access Analyzer AWS::AccessAnalyzer::Analyzer

IAM.23
AWS IoT AWS::IoT::Authorizer

IoT .4
AWS::IoT::Dimension

IoT
AWS::IoT::MitigationAction

IoT
AWS::IoT::Policy

IoT .6
AWS::IoT::RoleAlias

IoT .5
AWS::IoT::SecurityProfile

IoT
Amazon Kinesis AWS::Kinesis::Stream

Kinesis.1

中 Kinesis。2
AWS Key Management Service (AWS KMS) AWS::KMS::Alias

S3.17
AWS::KMS::Key

KMS.3

S3.17
AWS Lambda AWS::Lambda::Function

Lambda.1

Lambda.2

Lambda.3

Lambda.5

Lambda .6
Amazon MSK AWS::MSK::Cluster

MSK.1

MSK.2
Amazon MQ AWS::AmazonMQ::Broker

MQ.2

MQ.3

每小米

每米 5 米

每小米
AWS Network Firewall AWS::NetworkFirewall::Firewall

NetworkFirewall.1

NetworkFirewall.7

NetworkFirewall.9
AWS::NetworkFirewall::FirewallPolicy

NetworkFirewall.3

NetworkFirewall.4

NetworkFirewall.5

NetworkFirewall.8
AWS::NetworkFirewall::RuleGroup

NetworkFirewall.6
Amazon OpenSearch 服務 AWS::OpenSearch::Domain

Opensearch.1

Opensearch.2

Opensearch.3

Opensearch.4

Opensearch.5

Opensearch.6

Opensearch.7

Opensearch.8

打開搜索 .9

打開搜索 .10

打開搜索 .11
Amazon Relational Database Service（AmazonRDS） AWS::RDS::DBCluster

DocumentDB

DocumentDB

DocumentDB 4

DocumentDB 5

海王星 1

海王星 2

海王星 .4

海王星 .5

海王星 .7

海王星 .8

海王星 .9

RDS.7

RDS.12

RDS.14

RDS.15

RDS.16

RDS.24

RDS.27

RDS.28

RDS.34

RDS.35
AWS::RDS::DBClusterSnapshot

DocumentDB

海王星 .3

海王星 .6

RDS.1

RDS.4

RDS.29
AWS::RDS::DBInstance

RDS.2

RDS.3

RDS.5

RDS.6

RDS.8

RDS.9

RDS.10

RDS.11

RDS.13

RDS.17

RDS.18

RDS.23

RDS.25

RDS.30
AWS::RDS::DBSecurityGroup

RDS.31
AWS::RDS::DBSnapshot

RDS.1

RDS.4

RDS.32
AWS::RDS::DBSubnetGroup

RDS.33
AWS::RDS::EventSubscription

RDS.19

RDS.20

RDS.21

RDS.22
Amazon Redshift AWS::Redshift::Cluster

Redshift.1

Redshift.2

Redshift.3

Redshift.4

Redshift.6

Redshift.7

Redshift.8

Redshift.9

Redshift.10

Redshift .11
AWS::Redshift::ClusterParameterGroup

Redshift.2
AWS::Redshift::ClusterSnapshot

Redshift .13
AWS::Redshift::ClusterSubnetGroup

Redshift .14
AWS::Redshift::EventSubscription

Redshift .12
Amazon Route 53 AWS::Route53::HostedZone

香港路線
AWS::Route53::HealthCheck

路線
Amazon Simple Storage Service (Amazon S3) AWS::S3::AccessPoint

S3.19
AWS::S3::AccountPublicAccessBlock

S3.2

S3.3
AWS::S3::Bucket

S3.2

S3.3

S3.5

S3.6

S3.7

S3.8

S3.9

S3.10

S3.11

S3.12

S3.13

S3.14

S3.15

S3.17

S3.20
AWS Secrets Manager AWS::SecretsManager::Secret

SecretsManager.1

SecretsManager.2

SecretsManager.5
AWS Service Catalog AWS::ServiceCatalog::Portfolio

ServiceCatalog.1
Amazon 簡單電子郵件服務SES（Amazon AWS::SES::ConfigurationSet

SES.2
AWS::SES::ContactList

SES.1
Amazon 簡單通知服務（AmazonSNS） AWS::SNS::Topic

SNS.1

SNS.3
Amazon 簡單隊列服務（AmazonSQS） AWS::SQS::Queue

SQS.1

SQS.2
Amazon SageMaker AWS::SageMaker::NotebookInstance

SageMaker.2

SageMaker.3
AWS Step Functions AWS::StepFunctions::StateMachine

StepFunctions.1
AWS::StepFunctions::Activity

StepFunctions.2
AWS Transfer Family AWS::Transfer::Workflow

接送服務 1
AWS WAF AWS::WAF::Rule

WAF.6
AWS::WAF::RuleGroup

WAF.7
AWS::WAF::WebACL

WAF.1

WAF.8
AWS::WAFRegional::Rule

WAF.2
AWS::WAFRegional::RuleGroup

WAF.3
AWS::WAFRegional::WebACL

WAF.4
AWS::WAFv2::RuleGroup

WAF.12
AWS::WAFv2::WebACL

WAF.10

WAF.11
Amazon WorkSpaces AWS::WorkSpaces::WorkSpace

WorkSpaces.1

WorkSpaces.2

FSBP標準所需的資源

讓安 Security Hub 準確地報告啟用的發現 AWS 基礎安全性最佳做法 v1.0.0 (FSBP) 變更觸發的控制項使用 AWS Config 規則，您必須將這些資源記錄在 AWS Config。 若要取得有關此標準的更多資訊，請參閱AWS 基礎安全性最佳做法 v1.0.0 () 標準 FSBP。

服務 必要的資源

Amazon API 网关

AWS::ApiGateway::Stage

AWS::ApiGatewayV2::Stage

AWS AppSync

AWS::AppSync::GraphQLApi

AWS Backup

AWS::Backup::RecoveryPoint

AWS Certificate Manager (ACM)

AWS::ACM::Certificate

AWS CloudFormation

AWS::CloudFormation::Stack

Amazon CloudFront

AWS::CloudFront::Distribution

AWS CodeBuild

AWS::CodeBuild::Project

AWS::CodeBuild::ReportGroup

AWS DataSync

AWS::DataSync::Task

AWS Database Migration Service (AWS DMS)

AWS::DMS::Endpoint

AWS::DMS::ReplicationInstance

AWS::DMS::ReplicationTask

Amazon DynamoDB

AWS::DynamoDB::Table
Amazon EC2 Systems Manager（SSM）

AWS::SSM::AssociationCompliance

AWS::SSM::ManagedInstanceInventory

AWS::SSM::PatchCompliance

Amazon 彈性運算雲（EC2）

AWS::EC2::ClientVpnEndpoint

AWS::EC2::Instance

AWS::EC2::LaunchTemplate

AWS::EC2::NetworkAcl

AWS::EC2::NetworkInterface

AWS::EC2::SecurityGroup

AWS::EC2::Subnet

AWS::EC2::TransitGateway

AWS::EC2::VPNConnection

AWS::EC2::Volume

Amazon EC2 Auto Scaling

AWS::AutoScaling::AutoScalingGroup

AWS::AutoScaling::LaunchConfiguration

Amazon 彈性容器註冊表（AmazonECR）

AWS::ECR::Repository

Amazon 彈性容器服務（AmazonECS）

AWS::ECS::Cluster

AWS::ECS::Service

AWS::ECS::TaskDefinition

Amazon Elastic File System（AmazonEFS）

AWS::EFS::AccessPoint

AWS::EFS::FileSystem

Amazon EKS

AWS::EKS::Cluster

ElasticBeanstalk

AWS::ElasticBeanstalk::Environment

Elastic Load Balancing

AWS::ElasticLoadBalancing::LoadBalancer

AWS::ElasticLoadBalancingV2::LoadBalancer

ElasticSearch

AWS::Elasticsearch::Domain

AWS Glue

AWS::Glue::Job

AWS::Glue::MLTransform

AWS Identity and Access Management (IAM)

AWS::IAM::Group

AWS::IAM::Policy

AWS::IAM::Role

AWS::IAM::User

Amazon Kinesis

AWS::Kinesis::Stream

AWS Key Management Service (AWS KMS)

AWS::KMS::Key

AWS Lambda

AWS::Lambda::Function

Amazon MSK

AWS::MSK::Cluster

AWS Network Firewall

AWS::NetworkFirewall::Firewall

AWS::NetworkFirewall::FirewallPolicy

AWS::NetworkFirewall::RuleGroup

Amazon OpenSearch 服務

AWS::OpenSearch::Domain

Amazon Relational Database Service（AmazonRDS）

AWS::RDS::DBCluster

AWS::RDS::DBClusterSnapshot

AWS::RDS::DBInstance

AWS::RDS::DBSnapshot

AWS::RDS::EventSubscription

Amazon Redshift

AWS::Redshift::Cluster

Amazon Route 53

AWS::Route53::HostedZone

Amazon Simple Storage Service (Amazon S3)

AWS::S3::AccessPoint

AWS::S3::AccountPublicAccessBlock

AWS::S3::Bucket

Amazon 簡單通知服務（AmazonSNS）

AWS::SNS::Topic

Amazon 簡單隊列服務（AmazonSQS）

AWS::SQS::Queue

Amazon SageMaker

AWS::SageMaker::NotebookInstance

AWS Secrets Manager

AWS::SecretsManager::Secret

AWS Step Functions

AWS::StepFunctions::StateMachine

AWS WAF

AWS::WAF::Rule

AWS::WAF::RuleGroup

AWS::WAF::WebACL

AWS::WAFRegional::Rule

AWS::WAFRegional::RuleGroup

AWS::WAFRegional::WebACL

AWS::WAFv2::RuleGroup

AWS::WAFv2::WebACL

Amazon WorkSpaces

AWS::WorkSpaces::WorkSpace

所需的資源 CIS AWS 基礎基準

若要針對適用於網際網路安全中心的已啟用控制項執行安全性檢查 (CIS) AWS 基礎基準測試，Security Hub 可以執行安全 Amazon Web Services 中規定的檢查的確切審核步驟，或使用特定的 AWS Config 受管規則。

若要取得有關此標準的更多資訊，請參閱CIS AWS 基礎基準。

3.0.0 CIS 版所需的資源

使 Security Hub 準確地報告啟用 CIS v3.0.0 更改觸發控件的發現，這些控件使用 AWS Config 規則，您必須將這些資源記錄在 AWS Config.

服務 必要的資源

Amazon 彈性運算雲（AmazonEC2）

AWS::EC2::Instance

AWS::EC2::NetworkAcl

AWS::EC2::SecurityGroup

AWS Identity and Access Management (IAM)

AWS::IAM::Group

AWS::IAM::User

AWS::IAM::Role

Amazon Relational Database Service（AmazonRDS）

AWS::RDS::DBInstance

Amazon Simple Storage Service (Amazon S3)

AWS::S3::Bucket

1.4.0 CIS 版所需的資源

為了使 Security Hub 準確地報告啟用 CIS v1.4.0 更改觸發控件的發現，這些控件使用 AWS Config 規則，您必須將這些資源記錄在 AWS Config.

服務 必要的資源

Amazon 彈性運算雲（EC2）

AWS::EC2::NetworkAcl

AWS::EC2::SecurityGroup

AWS Identity and Access Management (IAM)

AWS::IAM::Policy

AWS::IAM::User

Amazon Relational Database Service（AmazonRDS）

AWS::RDS::DBInstance

Amazon Simple Storage Service (Amazon S3)

AWS::S3::Bucket

1.2.0 CIS 版所需的資源

使 Security Hub 準確地報告啟用 CIS v1.2.0 更改觸發控件的發現，這些控件使用 AWS Config 規則，您必須將這些資源記錄在 AWS Config.

服務 必要的資源

Amazon 彈性運算雲（EC2）

AWS::EC2::SecurityGroup

AWS Identity and Access Management (IAM)

AWS::IAM::Policy

AWS::IAM::User

第五版所NIST需的資源

為了使 Security Hub 準確地報告啟用的國家標準技術研究所（NIST）SP 800-53 修訂版 5 更改觸發了使用 AWS Config 規則，您必須將這些資源記錄在 AWS Config。 您只需記錄具有已觸發變更之排程型態之控制項的資源。若要取得有關此標準的更多資訊，請參閱NIST安全中心中的第五版。

服務 必要的資源

Amazon API 网关

AWS::ApiGateway::Stage

AWS::ApiGatewayV2::Stage

AWS AppSync

AWS::AppSync::GraphQLApi

AWS Backup

AWS::Backup::RecoveryPoint

AWS Certificate Manager (ACM)

AWS::ACM::Certificate

AWS CloudFormation

AWS::CloudFormation::Stack

Amazon CloudFront

AWS::CloudFront::Distribution

Amazon CloudWatch

AWS::CloudWatch::Alarm

AWS CodeBuild

AWS::CodeBuild::Project

AWS Database Migration Service (AWS DMS)

AWS::DMS::Endpoint

AWS::DMS::ReplicationInstance

AWS::DMS::ReplicationTask

Amazon DynamoDB

AWS::DynamoDB::Table

Amazon 彈性運算雲（EC2）

AWS::EC2::ClientVpnEndpoint

AWS::EC2::EIP

AWS::EC2::Instance

AWS::EC2::LaunchTemplate

AWS::EC2::NetworkAcl

AWS::EC2::NetworkInterface

AWS::EC2::SecurityGroup

AWS::EC2::Subnet

AWS::EC2::TransitGateway

AWS::EC2::VPNConnection

AWS::EC2::Volume

Amazon EC2 Auto Scaling

AWS::AutoScaling::AutoScalingGroup

AWS::AutoScaling::LaunchConfiguration

Amazon 彈性容器註冊表（AmazonECR）

AWS::ECR::Repository

Amazon 彈性容器服務（AmazonECS）

AWS::ECS::Cluster

AWS::ECS::Service

AWS::ECS::TaskDefinition

Amazon Elastic File System（AmazonEFS）

AWS::EFS::AccessPoint

Amazon EKS

AWS::EKS::Cluster

ElasticBeanstalk

AWS::ElasticBeanstalk::Environment

Elastic Load Balancing

AWS::ElasticLoadBalancing::LoadBalancer

AWS::ElasticLoadBalancingV2::LoadBalancer

ElasticSearch

AWS::Elasticsearch::Domain

Amazon EventBridge

AWS::Events::Endpoint

AWS::Events::EventBus

AWS Identity and Access Management (IAM)

AWS::IAM::Group

AWS::IAM::Policy

AWS::IAM::Role

AWS::IAM::User

AWS Key Management Service (AWS KMS)

AWS::KMS::Alias

AWS::KMS::Key

Amazon Kinesis

AWS::Kinesis::Stream

AWS Lambda

AWS::Lambda::Function

Amazon MSK

AWS::MSK::Cluster

Amazon MQ

AWS::AmazonMQ::Broker

AWS Network Firewall

AWS::NetworkFirewall::Firewall

AWS::NetworkFirewall::FirewallPolicy

AWS::NetworkFirewall::RuleGroup

Amazon OpenSearch 服務

AWS::OpenSearch::Domain

Amazon Relational Database Service（AmazonRDS）

AWS::RDS::DBCluster

AWS::RDS::DBClusterSnapshot

AWS::RDS::DBInstance

AWS::RDS::DBSnapshot

AWS::RDS::EventSubscription

Amazon Redshift

AWS::Redshift::Cluster

Amazon Route 53

AWS::Route53::HostedZone

Amazon Simple Storage Service (Amazon S3)

AWS::S3::AccountPublicAccessBlock

AWS::S3::AccessPoint

AWS::S3::Bucket

AWS Service Catalog

AWS::ServiceCatalog::Portfolio

Amazon 簡單通知服務（AmazonSNS）

AWS::SNS::Topic

Amazon 簡單隊列服務（AmazonSQS）

AWS::SQS::Queue
Amazon EC2 Systems Manager（SSM）

AWS::SSM::AssociationCompliance

AWS::SSM::ManagedInstanceInventory

AWS::SSM::PatchCompliance

Amazon SageMaker

AWS::SageMaker::NotebookInstance

AWS Secrets Manager

AWS::SecretsManager::Secret

AWS WAF

AWS::WAF::Rule

AWS::WAF::RuleGroup

AWS::WAF::WebACL

AWS::WAFRegional::Rule

AWS::WAFRegional::RuleGroup

AWS::WAFRegional::WebACL

AWS::WAFv2::RuleGroup

AWS::WAFv2::WebACL

3.2.1 PCI DSS 版所需的資源

為了讓 Security Hub 準確地報告已啟用的支付卡產業資料安全標準 (PCIDSS) 控制項的發現項目 AWS Config 規則，您必須將這些資源記錄在 AWS Config。 若要取得有關此標準的更多資訊，請參閱PCIDSS安全中心中的 v3.2.1。

服務 必要的資源

AWS CodeBuild

AWS::CodeBuild::Project

Amazon 彈性運算雲（EC2）

AWS::EC2::EIP

AWS::EC2::Instance

AWS::EC2::SecurityGroup

Amazon EC2 Auto Scaling

AWS::AutoScaling::AutoScalingGroup

AWS Identity and Access Management (IAM)

AWS::IAM::Policy

AWS::IAM::User

AWS Lambda

AWS::Lambda::Function

Amazon OpenSearch 服務

AWS::OpenSearch::Domain

Amazon Relational Database Service（AmazonRDS）

AWS::RDS::DBClusterSnapshot

AWS::RDS::DBInstance

AWS::RDS::DBSnapshot

Amazon Redshift

AWS::Redshift::Cluster

Amazon Simple Storage Service (Amazon S3)

AWS::S3::AccountPublicAccessBlock

AWS::S3::Bucket
Amazon EC2 Systems Manager（SSM）

AWS::SSM::AssociationCompliance

AWS::SSM::ManagedInstanceInventory

AWS::SSM::PatchCompliance

所需的資源 AWS 資源標記標準

中的所有控制項 AWS 資源標記標準被更改觸發並使用 AWS Config 規則。若要讓 Security Hub 準確地報告這些控制項的發現項目，您必須在中記錄下列資源 AWS Config。 您只需記錄具有已觸發變更之排程型態之控制項的資源。若要取得有關此標準的更多資訊，請參閱AWS 資源標記標準。

服務 必要的資源
AWS AppSync

AWS::AppSync::GraphQLApi
Amazon Athena

AWS::Athena::DataCatalog

AWS::Athena::WorkGroup
AWS Certificate Manager (ACM)

AWS::ACM::Certificate
AWS Backup (AWS Backup)

AWS::Backup::BackupPlan

AWS::Backup::BackupVault

AWS::Backup::RecoveryPlan

AWS::Backup::ReportPlan
AWS CloudFormation

AWS::CloudFormation::Stack
Amazon CloudFront

AWS::CloudFront::Distribution
AWS CloudTrail

AWS::CloudTrail::Trail
AWS CodeArtifact

AWS::CodeArtifact::Repository
Amazon Detective

AWS::Detective::Graph
AWS Database Migration Service (AWS DMS)

AWS::DMS::Certificate

AWS::DMS::EventSubscription

AWS::DMS::ReplicationInstance

AWS::DMS::ReplicationSubnetGroup
Amazon DynamoDB

AWS::DynamoDB::Trail
Amazon 彈性運算雲（EC2）

AWS::EC2::CustomerGateway

AWS::EC2::EIP

AWS::EC2::FlowLog

AWS::EC2::Instance

AWS::EC2::InternetGateway

AWS::EC2::NatGateway

AWS::EC2::NetworkAcl

AWS::EC2::NetworkInterface

AWS::EC2::RouteTable

AWS::EC2::SecurityGroup

AWS::EC2::Subnet

AWS::EC2::TransitGateway

AWS::EC2::TransitGatewayAttachment

AWS::EC2::TransitGatewayRouteTable

AWS::EC2::Volume

AWS::EC2::VPC

AWS::EC2::VPCEndpointService

AWS::EC2::VPCPeeringConnection

AWS::EC2::VPNGateway
Amazon EC2 Auto Scaling

AWS::AutoScaling::AutoScalingGroup
Amazon 彈性容器註冊表（AmazonECR）

AWS::ECR::PublicRepository
Amazon 彈性容器服務（AmazonECS）

AWS::ECS::Cluster

AWS::ECS::Service

AWS::ECS::TaskDefinition
Amazon Elastic File System（AmazonEFS）

AWS::EFS::AccessPoint
Amazon Elastic Kubernetes Service（Amazon）EKS

AWS::EKS::Cluster

AWS::EKS::IdentityProviderConfig
AWS Elastic Beanstalk (Elastic Beanstalk)

AWS::ElasticBeanstalk::Environment
ElasticSearch

AWS::Elasticsearch::Domain
Amazon EventBridge

AWS::Events::EventBus
AWS Global Accelerator

AWS::GlobalAccelerator::Accelerator
AWS Glue

AWS::Glue::Job
Amazon GuardDuty

AWS::GuardDuty::Detector

AWS::GuardDuty::Filter

AWS::GuardDuty::IPSet
AWS Identity and Access Management (IAM)

AWS::IAM::Role

AWS::IAM::User
AWS Identity and Access Management Access Analyzer （IAM訪問分析器）

AWS::AccessAnalyzer::Analyzer
AWS IoT

AWS::IoT::Authorizer

AWS::IoT::Dimension

AWS::IoT::MitigationAction

AWS::IoT::Policy

AWS::IoT::RoleAlias

AWS::IoT::SecurityProfile
Amazon Kinesis

AWS::Kinesis::Stream
AWS Lambda

AWS::Lambda::Function
Amazon MQ

AWS::AmazonMQ::Broker
AWS Network Firewall

AWS::NetworkFirewall::Firewall

AWS::NetworkFirewall::FirewallPolicy
Amazon OpenSearch 服務

AWS::OpenSearch::Domain
Amazon Relational Database Service

AWS::RDS::DBCluster

AWS::RDS::DBClusterSnapshot

AWS::RDS::DBInstance

AWS::RDS::DBSecurityGroup

AWS::RDS::DBSnapshot

AWS::RDS::DBSubnetGroup
Amazon Redshift

AWS::Redshift::Cluster

AWS::Redshift::ClusterSnapshot

AWS::Redshift::ClusterSubnetGroup

AWS::Redshift::EventSubscription
Amazon Route 53

AWS::Route53::HealthCheck
AWS Secrets Manager

AWS::SecretsManager::Secret
Amazon 簡單電子郵件服務SES（Amazon

AWS::SES::ConfigurationSet

AWS::SES::ContactList
Amazon 簡單通知服務（AmazonSNS）

AWS::SNS::Topic
Amazon 簡單隊列服務（AmazonSQS）

AWS::SQS::Queue
AWS Step Functions

AWS::StepFunctions::Activity
AWS Transfer Family

AWS::Transfer::Workflow

服務管理標準所需的資源： AWS Control Tower

若要讓 Security Hub 準確地報告已啟用服務管理標準的發現項目： AWS Control Tower 變更使用 a 的觸發控制項 AWS Config 規則中，您必須記錄下列資源 AWS Config。 若要取得有關此標準的更多資訊，請參閱服務管理標準： AWS Control Tower。

服務 必要的資源

Amazon API 网关

AWS::ApiGateway::Stage

AWS::ApiGatewayV2::Stage

AWS Certificate Manager (ACM)

AWS::ACM::Certificate

AWS CodeBuild

AWS::CodeBuild::Project

Amazon DynamoDB

AWS::DynamoDB::Table

Amazon 彈性運算雲（EC2）

AWS::EC2::Instance

AWS::EC2::NetworkAcl

AWS::EC2::NetworkInterface

AWS::EC2::SecurityGroup

AWS::EC2::Subnet

AWS::EC2::VPNConnection

AWS::EC2::Volume

Amazon EC2 Auto Scaling

AWS::AutoScaling::AutoScalingGroup

AWS::AutoScaling::LaunchConfiguration

Amazon 彈性容器註冊表（AmazonECR）

AWS::ECR::Repository

Amazon 彈性容器服務（AmazonECS）

AWS::ECS::Cluster

AWS::ECS::Service

AWS::ECS::TaskDefinition

Amazon Elastic File System（AmazonEFS）

AWS::EFS::AccessPoint

Amazon EKS

AWS::EKS::Cluster

ElasticBeanstalk

AWS::ElasticBeanstalk::Environment

Elastic Load Balancing

AWS::ElasticLoadBalancing::LoadBalancer

AWS::ElasticLoadBalancingV2::LoadBalancer

ElasticSearch

AWS::Elasticsearch::Domain

AWS Identity and Access Management (IAM)

AWS::IAM::Group

AWS::IAM::Policy

AWS::IAM::Role

AWS::IAM::User

AWS Key Management Service (AWS KMS)

AWS::KMS::Alias

AWS::KMS::Key

Amazon Kinesis

AWS::Kinesis::Stream

AWS Lambda

AWS::Lambda::Function

AWS Network Firewall

AWS::NetworkFirewall::FirewallPolicy

AWS::NetworkFirewall::RuleGroup

Amazon OpenSearch 服務

AWS::OpenSearch::Domain

Amazon Relational Database Service（AmazonRDS）

AWS::RDS::DBCluster

AWS::RDS::DBClusterSnapshot

AWS::RDS::DBInstance

AWS::RDS::DBSnapshot

AWS::RDS::EventSubscription

Amazon Redshift

AWS::Redshift::Cluster

Amazon Simple Storage Service (Amazon S3)

AWS::S3::AccountPublicAccessBlock

AWS::S3::Bucket

Amazon 簡單通知服務（AmazonSNS）

AWS::SNS::Topic

Amazon 簡單隊列服務（AmazonSQS）

AWS::SQS::Queue
Amazon EC2 Systems Manager（SSM）

AWS::SSM::AssociationCompliance

AWS::SSM::ManagedInstanceInventory

AWS::SSM::PatchCompliance

AWS Secrets Manager

AWS::SecretsManager::Secret

AWS WAF

AWS::WAFRegional::Rule

AWS::WAFRegional::RuleGroup

AWS::WAFRegional::WebACL

AWS::WAFv2::WebACL